(Maint) Give each test a meaningful name

The tests being put all together did not provide any explanation about
what was interesting about each situation. This obscures other
interesting cases that may not be covered and also provides little to no
specification to later developers who may need to know what the cases
being handled are.
(#20742) Handle DNs that cannot be parsed

When no DN is sent in a RACK setup (passenger behind apache), the DN
that the master sees for unauthenticated requests ends up being the
string "(null)". The openssl name parsing functions do not handle data
that doesn't look like a DN in a useful manner. If the string to be
parsed as a DN does not contain an equals sign ("="), then it will fail
with an error like:

  TypeError: can't convert nil into String
  # ./lib/puppet/util/ssl.rb:26:in `call'
  # ./lib/puppet/util/ssl.rb:26:in `block in subject_from_dn'
  # ./lib/puppet/util/ssl.rb:24:in `each'
  # ./lib/puppet/util/ssl.rb:24:in `subject_from_dn'

This same code also would fail with a OpenSSL::X509::NameError if the
parsed DN contained an unknown part (RDN), e.g. "no=yes".

This commit fixes the malformed DN by checking that the DN contains at
least an equals sign before trying to parse. It also then handles all
OpenSSL::X509::NameError problems.
(#20742) Only use certifcate info if there is a CN

Because of the changes to puppet/util/ssl for this issue, the DN
was now always able to be parsed into something. This uncovered that the
logic around deciding on the node name and authentication status for the
request was incorrectly based off of simply the existance of a DN in the
headers. This caused a DN that was missing a CN to have an unknown node
for a request, which could be marked as authenticated if the verify
header was "SUCCESS".

This patch fixes it by basing the decision of using the SSL headers on
the existance of the CN instead of the DN. Now a CN must be present
(e.g. a valid DN) for the verify header to be used. When no CN is
present, then it is treated the same as no DN being present, which
causes a reverse DNS lookup to be done for the node name.
Merge remote-tracking branch 'zaphod42/issue/stable/20742-no-handling-of-bad-dn-in-rack' into stable

* zaphod42/issue/stable/20742-no-handling-of-bad-dn-in-rack:
  (#20742) Only use certifcate info if there is a CN
  (#20742) Handle DNs that cannot be parsed
  (Maint) Give each test a meaningful name